{"id":"CVE-2021-27852","kind":"vulnerability","aliases":["CVE-2021-27852"],"related":[],"title":"Checkbox Checkbox Survey: Checkbox Survey Deserialization of Untrusted Data Vulnerability","description":"Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.\n\nCISA required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","summary":"Checkbox Survey's CheckboxWeb.dll deserializes untrusted data, so a remote request can trigger it. An unauthenticated attacker can execute arbitrary code on the server.","severity":"critical","cvss":9.8,"epss":0.30258,"exploited":true,"exploited_at":"2022-04-11T00:00:00+00:00","products":[{"name":"Checkbox Checkbox Survey","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["checkbox-survey","exploited","package","self-hosted","windows"],"not_affected_if":["version-7-or-later"],"how_to_check":"Find the Checkbox Survey install and check the version; versions 6 and earlier are end-of-life and in scope.","fix":"Upgrade to Checkbox Survey 7 or later, or remove version 6 and earlier from the network.","status":"open","published_at":"2021-05-27T21:15:20+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:18:01+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:18:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Checkbox Survey 7 or later, or remove version 6 and earlier from the network.\nunknown","reach":"internet","impact":"high","summary":"Checkbox Survey's CheckboxWeb.dll deserializes untrusted data, so a remote request can trigger it. An unauthenticated attacker can execute arbitrary code on the server.","category":"package","who_cares":["checkbox-survey","windows","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the server.","analyst_note":"Confirm exact affected version range and whether CISA KEV due date applies; check vendor advisory for the Checkbox Survey 6 end-of-life notice.","how_to_check":"Find the Checkbox Survey install and check the version; versions 6 and earlier are end-of-life and in scope.\nunknown","needs_analyst":true,"not_affected_if":["version-7-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2891,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':12A,15A '-27852':13A,16A '6':76C '7':95C 'action':74C 'agenc':92C 'allow':63C 'arbitrari':48B,70C 'attack':45B,67C 'checkbox':1A,2A,4A,17A,18A,21B,29B,61C 'checkbox-survey':20B 'checkboxweb.dll':32B,59C 'cisa':72C 'code':49B,71C 'consid':100C 'cve':11A,14A 'data':9A,35B,56C 'deseri':6A,33B,53C 'earlier':78C 'end':84C 'end-of-lif':83C 'execut':47B,69C 'exploit':23B 'host':27B 'later':97C 'life':86C 'must':88C 'network':93C 'packag':24B 'product':81C 'remot':38B,66C 'remov':90C 'request':39B 'requir':73C 'self':26B 'self-host':25B 'server':52B 'survey':3A,5A,19A,22B,30B,62C 'trigger':41B 'unauthent':44B,65C 'untrust':8A,34B,55C 'version':75C,94C 'vulner':10A,57C,101C 'window':28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-27T21:15:20+00:00","kev":{"dateAdded":"2022-04-11","dueDate":"2022-05-02","requiredAction":"Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cret@cert.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-27852","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27852","severity":null,"published_at":"2022-04-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:24+00:00","note":null},{"source":"epss","external_id":"CVE-2021-27852","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27852","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-27852","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27852","severity":null,"published_at":"2021-05-27T21:15:20+00:00","modified_at":"2026-06-17T03:45:31+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}